Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

Sparrowvsrevolution writes "Hackers linked with Anonymous leaked another 1.26 gigabytes of Symantec's data Monday night, what they say is the source code company's PCAnywhere program. More interestingly, also posted a long private email conversation that seems to show a Symantec exec offering the hackers $50,000 to not leak the company's data and to publicly state they had lied about obtaining it. Symantec has responded by revealing that in fact, the $50,000 offer had been a ruse, and the 'Symantec exec' was actually a law enforcement agent trying to trace the hackers. It adds that all the information the hackers have released, including a 2006 version of Norton Internet Security, is outdated and poses no threat to the company or its customers. Symantec says the Anonymous hackers began attempting to extort money from the company in mid-January, and it responded by contacting law enforcement, though it won't comment on the results of the fake payoff sting while the investigation is still ongoing."

..however, what they seemingly did propose - the cops/symantec,the symantec knew of the conversation taking place it's actually irrelevant if it was cops or symantec doing the offer, combined they just had no intention of actually paying- back to what they did propose: LYING TO SHAREHOLDERS ABOUT HAVING HACKED SYMANTEC.

I wouldn't really call it "entrapment." That's if a cop tries to get you to commit a crime you were unlikely to commit. If I hack a major security company and steal their source code blackmailing the company is going to be right there on the list next to "sell on black market." Plus, it's not extortion since the "Symantec Exec" offered the money first.

Last I checked, the police are totally allowed to lie to suspects. Anything from "last night, your momma said you always were a bad kid" to "we have the smoking gun and it points at you and is covered with every type of DNA imaginable (which would also make you a gun pervert) and it matches to you. It also says you're late on your alimony. "

That's if a cop tries to get you to commit a crime you were unlikely to commit. If I hack a major security company and steal their source code blackmailing the company is going to be right there on the list next to "sell on black market."

Are we now being judged by the crimes someone else believes we might commit?

Having followed the alleged Anonymous hacks, the only thing they seem likely to do is to publish the data they got. A cop offering something to get them to do anything else is entrapment.

It would only be entrapment if they hadn't already obtained the data. Entrapment would be convincing them to break in and get the data for money before they had already done so. Asking someone to sell you something they have already taken isn't really entrapment seeing the crime has already been committed.

If the source code was stolen for reasons other than extortion and the people who stole it are genuinely unlikely to commit extortion, then offering them money then turning around and claiming they're committing extortion is entrapment. Whether it is or isn't entrapment depends a lot on details that are currently secret, so all we can do is speculate.

They already committed the crimes involved in hacking in to get the code. That is a crime that they already committed. Extortion doesn't necessarily go along with that. It may well have been the intent, but that's something that has to be proven. If it isn't proven, then offering them money to comply with not releasing the code, then charging them with extortion after would be entrapment. Just using it as a trick to catch them, then just charging them with the crimes they had committed without it being sugg

It is a legitimate tactic to find them. Whether or not it's entrapment depends on whether or not they would be charged with extortion on top of the other crimes afterwards and, if they were, whether or not there was any evidence that they actually intended extortion before being offered money (likely they would have to prove that they didn't intend it rather than the prosecution proving they did).

"Anonymous hackers began attempting to extort money from the company in mid-January, and it responded by contacting law enforcement,"

In short, the hackers decided to try to extort Symantec and a police officer responded as if they were the executives. This is in no way entrapment and in no way reflects badly on the police at all. It was a perfectly reasonable attempt at tracking down the perpetrators. How successful it was or wasn't doesn't matter as a lot of law enforcement is trying different things until the criminals screw up. (And yes, the people that broke in to Symantec are criminals and don't deserve any respect or sympathy at all.)

As a person who is involved in this case (I'm with the cyber-crime unit of the FBI), I can confidently tell you that we've narrowed down our search (based on IP addresses) to a grandmother in a seniors home in Florida.

Little does she know that joining Anonymous does not make her Anonymous. As I write this, the government is in the process of seizing her assets. She thinks she's smart, but in the end she'll end up loosing everything, including her wheel chair.

I believe that someone broke in and stole stuff from Symantec. I think that much is real. What did they steal? I don't think that we know the extent. Worse, I don't think Symantec knows, and that the extortion plot is possibly a ruse to save face on Symantec's part. Symantec and Verisign.... it seems like a potentially coordinated effort. I wish I could believe Symantec, but they've lied before and I feel they're untrustworthy. Does this mean that the facts are different than what they claim? For me, only third party verification of the claims will make me believe them. "Hacker communiques" are somewhat meaningless until someone coughs more code. I'm betting there's much more stuff stolen, but this is only a feeling.

And I admit that Symantec might be submitting the facts. But I have to doubt it until the picture becomes clearer. The fact that they had no knowledge of the break-in means that other areas were also vulnerable, and they didn't know that. In an organization whose business is the best security, being breached successfully is tough to forgive. Add in the fact that they're still not sure of the extent, and it seems as though internal systems failure could have been rampant-- and maybe they'll never know, but would NEVER admit such a thing. Heads ought to roll there in a major way. Enrique leaves a negative legacy there....

Up til now, extortion has never been their stated goal. The question is, if someone calling themselves 'Anonymous' hacks your servers, how do you know if it's the 'real' Anonymous or an impostor - or some rogue member(s) of the real Anonymous? After all, they are anonymous.

Obviously, there's no way to tell - unless one maintains the belief/fantasy that nobody who's really a part of Anonymous would do that. Unless Anonymous is a much smaller collection (group implies too much) than we've been led to beli

The unfortunate fact for those who want to vilify business, or any other group, is that just like any other group, only a very small percentage of that group actually does that stuff. The vast, vast majority of business people (both statistically and in my own mid-size experience over 40 years) try to do the right thing all the time. It's not always obvious what the right thing is, but they try. Most businesses would rather not mess with politics at all, and many donate token amounts of money to campaign

The cesspool is you and me. They aren't any more dumb or smart than the individuals that compose them at any given time. Nothing is surprising about this unless you haven't been on the internet for a while.

Frightening if you're Big Brother. Seems Anonymous has been looking out for the little guy so far. I definitely wouldn't want to be a CEO of one of these evil megacorporations with Anonymous watching me.

If you spend at least a month in IT security you'll easily see why duh. When you decide for that path, well, at least when I decided, the goal was to make the systems of the companies I work for secure. Safe from hackers, secure against all kinds of attacks. That was the plan, that was the goal.

Now, about 10 years into the business, the dream has faded. That's not what I do. What I do is writing guidelines and processes nobody reads or bothers to heed, ticking off checklists to be compliant with some law from the ancient days (i.e. any time more than a year ago in security) and generally trying to cover my ass for the moment when (not if, when) the shit hits the fan.

Because secure, we are not. But we're compliant with about any security protocol or certificate you could name. From BS7799 to ISO27001, from NERC1300 to pretty much all of its CIP substandards. And some PCI-DSS on top. Audit us by any standard you please, free choice, we'll pass.

Compliance != Security, though. It's better than nothing, I give you that. And some kind of standard has to be found or nothing will ever improve. The problem is that managers don't give half a shit about security. What they care about is the legal matter behind it. It's commendable that our lawmakers finally realized that companies that store important and private data should be forced to uphold some kind of security standard.

If we could now get some security standards that deserve the name, we could start talking.

They would've taken the money. More likely they "offered" money whether it was in a sting or not in order to be able to claim extortion and put the Anonymous hackers in a bad light.

I don't think the hackers are interested in money as much as they are in the information. The fact is Symantec screwed up and they'll have to take it, if they can't protect themselves then why should we trust them?

I know that's what you want to believe, but read the emails. It's abundantly clear that they did want the money. The only reason they didn't get caught is because they refused to transfer the money in any way that might be traceable.

Anonymous are not the white knights you imagine them. Anyone can "be" them, and that causes them to attract a lot of thugs and sociopaths.

Naah. Somewhere between $1,000,000 and $50,000,000 buys a lot of anonymity. $50,000 just gets you started, after which you will have to spend your life being creative, staying on the run, living in odd and uncomfortable places, and never again seeing anyone you are related to or ever knew.

However, (while not explicitly mentioned in my orginal post) I was thinking of servers and software type anonymity. Not fleeing the country and living large in a Swiss Chalet or Grand Cayman Bungalow with my family and 10 friends under assumed identities certified by the state government.

Most people, including in Anon, don't have contacts with the sort of people who'd pay for the code. They would be fearful of contacting an undercover cop, of getting rooked, or of getting in over their heads.

Besides, I suspect they would have released the data whether they got paid or not. You know... "for the lulz."

I do not recall, and quick search did not return any prior example of, anonymous extorting info/data for money. Why attach this now? To me it reads more like "Anonymous ignores bribes, cop sting failed". Granted there have been threats of various sorts, but I cannot recall there being a money sum attached to any of them.

The only extortion is the fact that you have to pay to not have software (That you already paid for) screwing up.
On a serious note though, I didn't think Anonymous would ever be so stupid as to try and extort money from a big company. Execs would much rather see their family die than lose corporate profits.

.... Anonymous leaked... the source code company's PCAnywhere program... Symantec has responded... all the information the hackers have released... poses no threat to the company....

Its like they're tempting the world to diff their source code up against GPLed prior art to find license violations. I think it would be hilarious if it turns out pcanywhere was just a wrapped version of one of the numerous GPLed VNC implementations or similar.

Weel, it seems like Symantec isn't really telling the truth about PCAnywhere not posing a threat to its customers. A quote from this Feb 1, 2012 article [computerworlduk.com]:

Last week, the company took the highly unusual step of telling pcAnywhere users to disable the program based on a 2006 source code leak and this month's claims by members of Anonymous that they were mining the stolen code for vulnerabilities.

Symantec spokesman Brian Modena declined to declare the now-patched pcAnywhere as safe to use when asked that question multiple times, but hinted that the fixes the company has released were sufficient.

So I guess that if you patched your version of PCAnywhere then you're safe according to Symantec.

Do you have any proof that there might be violations or are you just proposing that any large, successful software project must be infringing on GPL software?

Proposing that "no threat to the company" implies they somehow comb their code to find GPL violations (how?), or they don't check so they might well exist. Or they think they're big enough to ignore any legal issues that might exist, which is frankly most likely to be true.

Its kind of pompous to declare someone elses code is no threat when you almost certainly have no idea if it is or not. That's what makes it hilarious if and/or when they're proven wrong.

Of course, anybody who's dealt with Anonymous knows they will try to get you to promise to sell out your customers or otherwise act in a way that's in your interests and detrimental to the interests of everyone you claim to 'protect'. They've done this multiple times. If I were an Anonymous target I would never agree to such a scheme because all that would happen would be that the conversation be published to make me look bad.

Of course, having it be a 'police sting operation' is a great way to make it look like you weren't really going to sell out your customers. And who knows, maybe it's even true. And maybe all that source code really is for 'old versions'.

But, the really incriminating evidence would be if there were emails showing that Symantec has been sponsoring or encouraging virus writers in some way. And I'm certain if Anonymous had that kind of evidence that it would be out in the open by now. So that means they don't. And maybe Symantec isn't as much of a sleaze bag company as I expected them to be.

As an aside, the only people who believe that Anonymous is after money are people who have already sold out their ethics. Generally a big part of their self-justification for having done so is that 'everybody does it', and so the idea that Anonymous is in it for anything but the money would induce major cognitive dissonance.

The tactic of trying to get your target to believe you want to extort them is a fantastic tactic for discovering people who deserve the kind of publicity it generates when you publish th

But, the really incriminating evidence would be if there were emails showing that Symantec has been sponsoring or encouraging virus writers in some way. And I'm certain if Anonymous had that kind of evidence that it would be out in the open by now. So that means they don't. And maybe Symantec isn't as much of a sleaze bag company as I expected them to be.

Do you really think that conspiracy is plausible? Just consider how much money there is to make by writing malware and, suddenly, Symantec doesn't have to get its hands dirty to have a running business.

Let's see... grinds system to a halt, hard if not impossible to remove short of a reinstall, gives you no information what it actually does, contacts its maker and downloads code after sending god knows what...

How would they receive the $50K anyway? Split it up between all members who are supposed to be anonymous?
Symantec/Police: Who do we make this check out to?
Anonymous: Cash.
Symantec/Police: Damn, foiled again!

However if you only really do one thing, that you sell. Then you epically fail at it, to the point that its not even your customers that are getting owned, but your own company. Then Announce it to the world, "Hey look at us, we are a bunch of stupid idiots!"

I can't see how this company even exists anymore. You can get FREE software that does a better job.

... if it wasn't the case before, it sure is now that as distasteful as payoffs may be, they are no longer going to be an option, even if they might have been the best possible option for some corporation/entity.

The source is out there, so what? It's still protected by copyright, and most people won't be able to compile it.

It's not like anyone can use it, apart from doing security-analysis and either sending symantec patches, or hacking their customers. And in that respect, it's not different than any open source software.

(Well, of course, if you got a 10 year open source history, chances are your code is much better than if it gets accidentally released after years of bad practice. So this will hurt in the beginni

why would a thief pay for the security details of a facility when it's guarded by a blind guy, a narcoleptic, and an old guy who may actually be dead? they wouldn't. so why would blackhats shell out the money for the source code when the program is stupidly easy to get around?

there is one - the norton removal tool. removing norton was such a nightmare that symantic realized that norton had essentially become a virus, ie: affects system performance, collects user information, regularly "calls home" to upload undisclosed user details and downloads code without asking for permission, restricts programs from running or accessing system resources, and is nightmarishly hard to get rid of. with the removal tool, its actually quite easy to get rid of though. i used to run a repair sh